1 of 21

Cybersecurity Fundamentals�Worksheet�Prepared by: Justin David Pineda

Group #:

Names:

    • Member 1
    • Member 2
    • Member 3
    • Member 4

Date:

1 - Cybersecurity Fundamentals Worksheet | J. Pineda | Jun 2026

1

2 of 21

Instructions

  • Use this worksheet to answer the exercises in the workshop.
  • Assign a recorder who will compile the answers but everybody must participate.
  • You may add slides if necessary.
  • Save the PPT as PDF and send to justinp@pinedacybersecurity.com with
    • Subject: CF– Exercises – Group #
  • Note: You need to submit all exercises to get the Certificate of Completion with Numerical Grade

1 - Cybersecurity Fundamentals Worksheet | J. Pineda | Jun 2026

2

3 of 21

Exercise 1: General Security Concepts (Waymo v. Uber) - 1 hour

1 - Cybersecurity Fundamentals Worksheet | J. Pineda | Jun 2026

3

4 of 21

Question 1 – Looking Beyond Technology

If you were part of Waymo's executive leadership team, what do you believe was the organization's biggest cybersecurity failure?

Was it primarily a:

• People problem?

• Process problem?

• Technology problem?

• Governance problem?

Explain your answer.

​

1 - Cybersecurity Fundamentals Worksheet | J. Pineda | Jun 2026

4

5 of 21

Question 2 – Protecting What Matters

The module discussed that organizations cannot protect everything equally.

If you were Waymo's Chief Information Security Officer (CISO), identify the five most important assets that should receive the highest level of protection.

Justify your choices.

​

1 - Cybersecurity Fundamentals Worksheet | J. Pineda | Jun 2026

5

6 of 21

Question 3 – CIA Triad

Using the Confidentiality, Integrity, and Availability model:

• Which principle was most affected?

• Could the other two principles also have been affected?

• Rank them from highest to lowest impact.

Support your ranking.

​

1 - Cybersecurity Fundamentals Worksheet | J. Pineda | Jun 2026

6

7 of 21

Question 4 – Trust versus Security

Levandowski never hacked the company.

He simply used access that had already been granted to him.

Discuss:

• Should organizations fully trust senior employees?

• At what point does trust become a cybersecurity risk?

• How can organizations balance employee productivity with security?

​

1 - Cybersecurity Fundamentals Worksheet | J. Pineda | Jun 2026

7

8 of 21

Question 5 – Applying Security Principles

From Module 1, choose three of the following principles that would have had the greatest impact if properly implemented:

• Least Privilege

• Separation of Duties

• Implicit Deny

• Job Rotation

• Defense in Depth

• Diversity of Defense

• Security Through Obscurity

• Protect = Prevent + Detect + Respond

Explain why your group selected these three.

​

1 - Cybersecurity Fundamentals Worksheet | J. Pineda | Jun 2026

8

9 of 21

Question 6 – Security Services vs. Security Mechanisms

Select one organizational area below.

• Physical Security

• Human Resources

• IT Operations

• Network Security

• Endpoint Security

• Data Protection

Identify:

• The security service(s) that should exist.

• The security mechanism(s) that should support those services.

Discuss why both are needed instead of relying solely on technology.

​

1 - Cybersecurity Fundamentals Worksheet | J. Pineda | Jun 2026

9

10 of 21

Question 7 – NIST Cybersecurity Framework

​

Map the case to the five NIST Cybersecurity Framework functions introduced in Module 1.

For each function, identify:

• What Waymo did well.

• What Waymo could have improved.

​

1 - Cybersecurity Fundamentals Worksheet | J. Pineda | Jun 2026

10

11 of 21

Question 8 – Executive Reflection

Imagine you are invited to present this incident to your own organization's executive committee.

Complete the following statement:

"The biggest lesson my organization should learn from the Waymo incident is..."

Each member of the group should provide one lesson based on his or her professional background.

​

1 - Cybersecurity Fundamentals Worksheet | J. Pineda | Jun 2026

11

12 of 21

Exercise 2: Threats and Risks (Equifax) - 1 hour

1 - Cybersecurity Fundamentals Worksheet | J. Pineda | Jun 2026

12

13 of 21

Objective

Your group has been engaged as an independent cybersecurity consulting team to perform an initial qualitative risk assessment of the Equifax incident.

​

Using the case provided, discuss the incident and identify the risks affecting the organization. Your final output should not be a separate worksheet. Instead, your group will encode the agreed-upon answers into the Risk Assessment System and generate the official PDF Risk Assessment Report.

​

Risk Assessment System

​

https://risk-assessment-system.streamlit.app/

1 - Cybersecurity Fundamentals Worksheet | J. Pineda | Jun 2026

13

14 of 21

1. Business Context

Before identifying risks, discuss the following:

​

What is Equifax's primary business?

What are the organization's most valuable assets?

Why would these assets be attractive to threat actors?

1 - Cybersecurity Fundamentals Worksheet | J. Pineda | Jun 2026

14

15 of 21

2. Threat Identification

Discuss all possible threats mentioned or implied in the case.

​

Examples may include:

​

External attackers

Insider threats

Human error

Process failures

Third-party risks

Technology failures

​

Question

​

Which threats do you believe present the greatest risk to Equifax?

1 - Cybersecurity Fundamentals Worksheet | J. Pineda | Jun 2026

15

16 of 21

3. Vulnerability Identification

Identify weaknesses that contributed to the incident.

​

Consider vulnerabilities involving:

​

Administrative controls

Physical controls

Technical controls

​

Question

​

Which vulnerabilities could have been prevented through better governance rather than better technology?

1 - Cybersecurity Fundamentals Worksheet | J. Pineda | Jun 2026

16

17 of 21

4. Risk Prioritization

​

Not every risk deserves the same attention.

​

Discuss:

​

Which risks are Critical?

Which are High?

Which are Medium?

Which are Low?

​

Be prepared to justify your ratings.

1 - Cybersecurity Fundamentals Worksheet | J. Pineda | Jun 2026

17

18 of 21

5. Risk Treatment

​

For each significant risk, discuss the most appropriate treatment strategy.

​

Should Equifax:

​

Accept the risk?

Mitigate the risk?

Avoid the risk?

Transfer the risk?

​

Explain why.

1 - Cybersecurity Fundamentals Worksheet | J. Pineda | Jun 2026

18

19 of 21

6. Recommended Controls

​

Discuss controls that would reduce the identified risks.

​

Think about:

​

Policies

Procedures

Employee awareness

Physical security

Technical safeguards

Monitoring

Governance

1 - Cybersecurity Fundamentals Worksheet | J. Pineda | Jun 2026

19

20 of 21

7. Executive Reflection

Finally, discuss:

​

If your group had been hired as Equifax's cybersecurity consultants before the breach, what are the three recommendations you would have immediately presented to senior management?

1 - Cybersecurity Fundamentals Worksheet | J. Pineda | Jun 2026

20

21 of 21

Next Steps

  • Save the PPT as PDF and send to justinp@pinedacybersecurity.com with
    • Subject: CF– Exercises – Group #
  • Note: You need to submit all exercises to get the Certificate of Completion with Numerical Grade

​

1 - Cybersecurity Fundamentals Worksheet | J. Pineda | Jun 2026

21